TQH-C2: An Encrypted Command-and-Control Traffic Dataset Across Protocols and Encryption Layers

TQH-C2 (TLS + QUIC + HTTP Command-and-Control) is a labeled network-traffic dataset for research on decryption-free detection of encrypted C2 channels. Its defining property is a controlled comparison across encryption profiles: the same MITRE ATT&CK kill-chain is executed identically over three encrypted C2 transports — Sliver over TLS (Testbed A), Merlin over HTTP/3/QUIC (Testbed B), and Mythic over HTTP with AES-encrypted body (Testbed C) — so that the only systematically varied factor is the encryption/transport profile.

The dataset is organized as a 36-cell grid: 3 encryption profiles × 4 beacon intervals (30/300/1800/3600 s) × 3 jitter levels (0/30/70%), with concurrent benign background traffic in every cell. The release includes raw PCAPs per cell, Zeek logs, per-flow ATT&CK labels (labeled.jsonl), extracted feature tables (Parquet) with JA4/JA4S/JA4H fingerprint columns, sanitized collection/labeling/feature-extraction code for reproducibility, and SHA-256 checksums. See README.md for full documentation.